US8433925B2 - Cryptographic system for performing secure computations and signal processing directly on encrypted data in untrusted environments - Google Patents

Cryptographic system for performing secure computations and signal processing directly on encrypted data in untrusted environments Download PDF

Info

Publication number
US8433925B2
US8433925B2 US12/876,223 US87622310A US8433925B2 US 8433925 B2 US8433925 B2 US 8433925B2 US 87622310 A US87622310 A US 87622310A US 8433925 B2 US8433925 B2 US 8433925B2
Authority
US
United States
Prior art keywords
encrypted
secure
cryptographic system
protocol
linear equations
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active, expires
Application number
US12/876,223
Other versions
US20110060917A1 (en
Inventor
Juan Ramon Troncoso Pastoriza
Pedro Comesana Alfaro
Fernando Perez Gonzalez
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Gradiant Centro Tecnoloxico de Telecomunicacions de Galicia
Original Assignee
Gradiant Centro Tecnoloxico de Telecomunicacions de Galicia
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Gradiant Centro Tecnoloxico de Telecomunicacions de Galicia filed Critical Gradiant Centro Tecnoloxico de Telecomunicacions de Galicia
Priority to US12/876,223 priority Critical patent/US8433925B2/en
Publication of US20110060917A1 publication Critical patent/US20110060917A1/en
Priority to US13/761,448 priority patent/US8972742B2/en
Assigned to GRADIANT reassignment GRADIANT ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: COMESANA ALFARO, PEDRO, PEREZ GONZALEZ, FERNANDO, Troncoso Pastoriza, Juan Ramon
Application granted granted Critical
Publication of US8433925B2 publication Critical patent/US8433925B2/en
Active legal-status Critical Current
Adjusted expiration legal-status Critical

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/76Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information in application-specific integrated circuits [ASIC] or field-programmable devices, e.g. field-programmable gate arrays [FPGA] or programmable logic devices [PLD]
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60Protecting data
    • G06F21/62Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245Protecting personal data, e.g. for financial or medical purposes
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/72Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information in cryptographic circuits
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/008Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols involving homomorphic encryption
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/04Masking or blinding
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/08Randomization, e.g. dummy operations or using noise

Definitions

  • Disclosed embodiments relate to cryptography methods and systems. Specifically, they relate to cryptosystems for the execution of operations directly on encrypted data.
  • the secure clinical data management system containing the encrypted clinical data and physiological time-series corresponding to a particular study, research, or clinical trial requires the authorized researcher to decrypt the data in order to perform the needed mathematical analysis, signal processing, and statistical analysis in order to generate the study results.
  • this conventional framework does not meet the security requirements, that is, in order to analyze and process the encrypted data, such data should not be first decrypted (i.e. the data should be kept encrypted at all times).
  • data should be completely private even to researchers, clinical administrators, and system administrators. This may be due to purely privacy reasons or due to research considerations. For instance, certain studies may require scientists and researchers to be completely blinded and the hypothesis and analysis methods to be chosen a-priori. In order to accomplish this, methods for performing the typical mathematical operations and computations including statistical analysis techniques, algebraic methods, signal processing methods, and other computation operations directly on the encrypted datasets are needed.
  • the availability of such secure methods and cryptosystems is limited.
  • the proposed system involves a cryptographic system (i.e. a cryptosystem) for the execution of operations directly on encrypted data, that is, a system designed to address the problem of efficiently processing signals in untrusted environments, where not only the communication channel between parties is unsecure, but also the parties that perform the computation cannot be trusted.
  • a cryptographic system i.e. a cryptosystem
  • Disclosed embodiments include a cryptographic system implemented in at least one digital computer with one or more processors or hardware such as FPGAs for performing secure computations, analysis, and signal processing directly on encrypted data in untrusted environments.
  • the proposed cryptographic system comprises: (a) at least one secure protocol for performing matrix multiplications in the encrypted domain, and (b) at least one secure protocol for solving systems of linear equations in the encrypted domain.
  • the system comprises a plurality of privacy-preserving protocols for solving systems of linear equations (SLE) directly based on homomorphic computation and secret sharing. More specifically, according to a particular embodiment, and without limitation, the system uses a protocol whereby systems of linear equations are solved securely by direct Gaussian elimination using a secure protocol without imposing any restrictions on the matrix coefficients.
  • FIG. 1 shows a block diagram to illustrate the cryptographic system according to one embodiment.
  • FIG. 2 shows a high level block diagram to illustrate the operation of the cryptographic system.
  • FIG. 3 shows a block diagram to illustrate the secure protocol for solving systems of linear equations in the encrypted domain according to one embodiment.
  • FIG. 1 shows a block diagram of the cryptographic system 102 according to one embodiment.
  • the embodiments disclosed describe how to realize a cryptographic system 102 for performing secure mathematical computations, signal processing, statistical signal processing, statistics, and data analysis directly on encrypted data 100 in untrusted environments.
  • the system involves a cryptosystem 102 for the execution of operations directly on encrypted data 100 , that is, a system designed to address the problem of efficiently processing signals in untrusted environments, where not only the communication channel between parties is unsecure, but also the parties that perform the computation cannot be trusted.
  • aspects of the disclosed embodiments may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network.
  • program modules may be located in both local and remote storage media including memory storage devices.
  • the cryptographic system 102 is implemented in a digital computer with one or more processors for performing secure computations and signal processing directly on encrypted data 100 in untrusted environments, said cryptographic system 102 comprises: (a) at least one secure protocol for performing matrix multiplications in the encrypted domain 104 , and (b) at least one secure protocol for solving systems of linear equations in the encrypted domain 106 .
  • the system uses a protocol whereby systems of linear equations are solved securely by direct Gaussian elimination using a secure multiplication protocol to directly generate the results 112 of such secure mathematical computations, signal processing, statistical signal processing, statistics, and data analysis directly on encrypted data 100 in untrusted environments.
  • the disclosed cryptosystem can be implemented in other hardware besides a digital computer including microcontrollers, DSPs, FPGAs or ASICs, as well as in firmware and software.
  • the disclosed embodiments of the cryptosystem 102 and associated secure protocols have specific and substantial utility by themselves as systems and methods for cryptography and secure (encrypted) computation but also in a variety of practical applications in diverse fields including secure clinical data management systems, secure web-enabled platforms for collaboration involving privacy data, secure law enforcement systems, secure financial systems, and secure military systems involving transmission of encrypted data to be processed in real-time without decryption.
  • the proposed cryptographic system 102 comprises: (a) at least one secure protocol for performing matrix multiplications in the encrypted domain 104 , and (b) at least one secure protocol for solving systems of linear equations in the encrypted domain 106 whereby systems of linear equations are solved securely by direct Gaussian elimination using a secure multiplication protocol based on homomorphic computation 108 and secret sharing 110 without placing any restrictions on the nature of the matrix coefficients (i.e. the matrix coefficients can be real numbers or complex numbers).
  • the embodiments of the disclosed cryptosystem 102 can be used to perform direct analysis and processing in encrypted clinical, financial, national security, military, law enforcement, and political data without the need to decrypt said data prior to performing said analysis and processing.
  • the disclosed cryptosystem 102 can be used to realize and implement a secure clinical system wherein all patient data, clinical history, clinical data, physiologic data and time series, biochemical data, and drug therapy data are encrypted at all times for secure transmission, management, and collaboration among researchers and clinicians; and all operations, processing, and statistical analysis performed on such data is conducted on the encrypted domain (i.e. with the data encrypted at all times).
  • a specific particular embodiment of such secure clinical data management and analysis system comprises (a) at least one secure protocol for performing matrix multiplications in the encrypted domain 104 , and (b) at least one secure protocol for solving systems of linear equations in the encrypted domain 106 in addition to the well-known elements comprising clinical management systems.
  • such protocol for solving systems of linear equations in said secure clinical data management system is based on a direct implementation of Gaussian elimination using a secure protocol.
  • FIG. 2 shows a high level diagram to illustrate the operation of the cryptographic system according to one embodiment.
  • the first party owns an encrypted matrix [[A]] and an encrypted vector [[b]], as well as the key for producing encryptions using a homomorphic encryption 202 .
  • the party owns both the encryption and decryption key 216 for the same homomorphic encryption.
  • This cryptographic system comprises a protocol of communication between both ends 208 and 214 that defines the operations performed and the format of the interchanged numbers in order to interactively solve the system without disclosing any information.
  • This communication takes place over any communication channel 210 (e.g., a wired or wireless medium or a sole device).
  • Secure matrix multiplication linear transformations
  • linear transformations linear transformations
  • linear systems of equations in the encrypted domain are fundamental mathematical building blocks to solve a great variety of problems involving data analysis, time-series analysis, digital signal processing, statistical signal processing, optimal filtering, adaptive filtering, digital communications, coding, encryption, information theory, and any other problem involving the least squares framework and representation of signals in vector spaces.
  • the encryption of a number x is represented by [[x]]
  • the vector (matrix) formed by the encryptions of the vector x (matrix X) is represented by [[x]] ([[X]]).
  • the complexity of basic modular operations like additions (A), products (P) and exponentiations (X) is denoted by Comp A , Comp P , Comp X respectively, prefixing an E (i.e. EA, EP, EX) when they are performed under encryption.
  • E i.e. EA, EP, EX
  • the factor ct ⁇ 1 denotes the ratio between the size of a clear-text value and that of an encrypted value.
  • the subscript cm denotes communication complexity, measured in number of sent encryptions, while cp indicates computational complexity, with an indication of the party whose complexity is represented.
  • the cryptographic system 102 uses secure multiparty computation techniques including homomorphic encryption and secret sharing.
  • the cryptographic system 102 makes use of homomorphisms between the groups of clear-text and cipher-text, that allow for the execution of a given operation directly on encrypted values, without the need for decryption.
  • the methods implemented are not restricted to the use of cryptosystem for the presented protocols, as far as it presents an additive homomorphism.
  • the system 102 uses an extension of Paillier encryption in its threshold and non-threshold form; that is, a k out of M threshold public key encryption system is a cryptosystem where the private key is distributed among M parties, and at least k of them are needed for decryption.
  • the cryptographic system 102 makes use of secret sharing.
  • a given value (the secret) is divided among several parties, such that the cooperation among a number of these parties is needed in order to recover the secret. None of the parties alone can have access to the secret.
  • the scheme is based on polynomials, and the need of k points in order to completely determine a degree (k ⁇ 1) polynomial.
  • the disclosed embodiment uses secret sharing for two-party protocols based on linear functions, without limitation, since each party can represent a plurality of entities.
  • the system supports the computation of sums and products directly on the shares as follows: 1) let be the domain of the secrets; 2) then, a share of a secret x is defined as two values x A and x B , owned by their respective parties, such that x A +x B ⁇ mod n; 3) hereinafter, randomizing an encrypted value x means obtaining one share and providing the encryption of the other (through homomorphic addition).
  • the protocols are based on two parties, and , both using an additively homomorphic cryptosystem in an asymmetric scenario, where can only encrypt, but also possesses the decryption key, and can perform both encryption and decryption.
  • the system requires that owns an encrypted version of the system matrix [[A]], and of the independent vector [[b]].
  • the SLE may have A being either a positive definite matrix or a strictly diagonally dominant matrix. In this particular case, it can be guaranteed both a solution to the system and the convergence of the studied methods, as detailed later.
  • the cryptosystem 102 is especially adapted for semi-honest parties, in the sense that they adhere to the established protocol, but they can be curious about the information they can get from the interaction.
  • the protocols can be proven private; informally, both parties and can only get the information leaked from the solution to the system, and no information is leaked from the intermediate steps of the protocols.
  • the secure protocol and without limitation, it is assumed that there exists an additively homomorphic cryptosystem with plaintext in such that can decrypt and both and can encrypt.
  • the procedure is analogous, with the exception that the random values must be generated by both parties.
  • the protocol is exactly the same as the scalar-scalar case, with L ⁇ M scalar products in parallel.
  • all the scalar products are performed using the scalar-scalar product protocol in parallel, with only one randomization per matrix coefficient, and the remaining operations are sums, that can be performed homomorphically.
  • in order to minimize the computation and communication complexity may let perform all the partial additions that can do in the clear and would need to do homomorphically.
  • FIG. 3 shows a block diagram of the direct method for solving systems of linear equations in the encrypted domain according to one embodiment.
  • the cryptosystem 102 includes a method for solving systems of linear equations directly on the encrypted data 100 (i.e. without the need to decrypt the data). The method is based on Gaussian elimination, using the secure multiplication protocol for implementing the needed multiplications. Due to the lack of a division operation under encryption, according to one embodiment of the method and cryptosystem 102 the obtained result vector is scaled, but the scale factors are stored in a second vector s, so that the solution can be recovered after decryption through a component-wise division.
  • the protocol ends with two vectors x′ and s, being the solution to the system
  • L denote the dimension of the system matrix A.
  • the system repeats the following steps: randomizes the encryptions of [[C (k) ]] 300 ; sends the randomized encryptions of [[C (k) ]] to 302 ; calculates the products [[D (k) ]] and [[E (k) ]], using the received encryptions 304 ; sends the encrypted [[D (k) ]] and [[E (k) ]] to 306 ; calculates [[G (k) ]] and [[C (k+1) ]], using the received encryptions 308 .
  • a ⁇ L ⁇ L( ) be a quantized symmetric positive-definite matrix, or a diagonally dominant matrix
  • b ⁇ be a quantized column vector.
  • the quantization step ⁇ is such that the absolute value of every quantized element is upper bounded by a constant T.
  • the protocol is described in detail as follows.
  • the algorithm is executed in L ⁇ 1 steps. At each step k, the matrix G is modified to obtain an equivalent system G (k) in which the k-th unknown is not present in the last L ⁇ k equations.
  • the first k ⁇ 1 elements of the L ⁇ k+1 last rows of G (k ⁇ 1) are zero; owns an encrypted version of the non-zeroed elements of G (k ⁇ 1) .
  • the secure protocol proceeds as follows:
  • both parties initiate the process of back substitution under encryption, consisting of L iterations: in each iteration, an element of the vector x′ and the corresponding element of the scale vector s are obtained. As they are revealed at the output, and they are needed in order to calculate the subsequent elements of x′, they can be decrypted before the next iteration in order to lower the complexity by reducing the number of the needed multiplication protocols.
  • L iterations in each iteration, an element of the vector x′ and the corresponding element of the scale vector s are obtained. As they are revealed at the output, and they are needed in order to calculate the subsequent elements of x′, they can be decrypted before the next iteration in order to lower the complexity by reducing the number of the needed multiplication protocols.
  • the system does not disclose any element of the original matrix A nor of the independent terms vector b. Furthermore, every step of the protocol can be proven secure with semi-honest parties, due to the semantical security of the underlying homomorphic cryptosystem, the security of the used multiplication protocols, and the fact that all the unencrypted values (besides the result and the scaling vector) that each party can access are random and uncorrelated. Nevertheless, the scaling vector reveals the diagonal of the upper triangular matrix of an equivalent system, which gives information about the eigenvalues of the original matrix. This information affects L scaled elements out of
  • this disclosed embodiment constitutes a clear advantage in terms of conditioning and efficiency: before executing the back substitution protocol, the rows of G (L) can be multiplied by appropriate factors in order to lower the condition number and minimize error propagation due to working with a fixed point precision. Also, the vector of multiplicative factors s i can be adequately quantized in the clear to achieve this same goal.
  • the disclosed embodiment of the protocol does not limit the number N of SLEs sharing the same system matrix A and with different independent term vectors b i that can be solved in parallel; all the vectors b i can be appended to the system matrix, forming a L ⁇ (L+N) matrix G ext and at each step of the previous protocol, the operations that must be performed on the last column of G (k) are replicated for the last N columns of G ext (k) .
  • the Gaussian Elimination (GE) protocol is performed in (L ⁇ 1) rounds of communication, with total complexity
  • Comp cmBS 2 ⁇ L ⁇ ( 1 + ct ) Comp cpBS
  • A 1 2 ⁇ ( L 2 + L - 2 ) ⁇ Comp EP + 1 2 ⁇ ( L 2 - L ) ⁇ Comp EA Comp cpBS
  • B 2 ⁇ LComp Decrypt .
  • the coefficients of the system matrix A are quantized versions of the real-valued coefficients, with a quantization step ⁇ . Furthermore, the absolute value of the quantized coefficients is bounded by an integer T>0. Then, it is possible to estimate the value of T needed to fit all the performed operations inside a cipher that can represent integers in the range [0, n) without rounding problems.
  • each iteration multiplies two numbers that were obtained in the previous iteration and adds them up, so the previous bound gets squared and doubled:
  • the diagonal elements can be re-quantized in order to make them relative to the lowest scale and lower the bit-size requirements of the cipher; but in the worst case, without re-quantizing the scale factors, the largest number present after running the whole protocol is 2 2 L ⁇ 1 T 2 1+L ⁇ 4 . That also constrains the size of the cipher.
  • the protocol presented in the earlier section does not impose any restrictions on the matrix coefficients. It can be used for both unrestricted real coefficients and complex coefficients. In this section we explain how the protocol can be implemented in the case of complex coefficients.
  • the complex addition operation can be performed through two real additions; thus, it can be performed homomorphically between two encrypted complex numbers as two homomorphic real additions.
  • the complex product when it involves one known factor and one encrypted number, it can also be performed homomorphically as four homomorphic multiplications and two homomorphic additions.
  • it is performed through four parallel (real) scalar multiplication protocols and two homomorphic additions.
  • the matrix multiplication protocol disclosed in the previous section works on complex numbers by adopting the proposed encrypted complex representation, and by substituting the real additions and products by their corresponding complex operations.
  • the communication complexity is doubled, the number of performed products is multiplied by four, and the number of performed additions is doubled.

Abstract

Disclosed embodiments include a cryptographic system implemented in at least one digital computer with one or more processors or hardware such as FPGAs for performing secure computations, analysis, and signal processing directly on encrypted data in untrusted environments. According to a basic embodiment, the proposed cryptographic system comprises: (a) at least one secure protocol for performing matrix multiplications in the encrypted domain, and (b) at least one secure protocol for solving systems of linear equations in the encrypted domain. According to a particular embodiment, the system comprises a plurality of privacy-preserving protocols for solving systems of linear equations (SLE) directly based on homomorphic computation and secret sharing. More specifically, according to a particular embodiment, the system uses a protocol whereby systems of linear equations are solved securely by direct Gaussian elimination using a secure protocol without imposing any restrictions on the matrix coefficients.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS
This application claims the benefit of U.S. Provisional Application No. 61/240,177 filed on 2009 Sep. 4 by the present inventors, which is incorporated herein by reference.
TECHNICAL FIELD
Disclosed embodiments relate to cryptography methods and systems. Specifically, they relate to cryptosystems for the execution of operations directly on encrypted data.
BACKGROUND
In modern society, digital data about individuals can be found relatively easily in the communication networks, especially the Internet. Although the public supports the last decades' advances in digital networks, the sensitive nature of this data motivates the raise of an increasing concern about the public availability of personal data, and the processing performed on it. For instance, in Europe this concern has been reflected in a series of Directives, dealing with the protection of individuals' personal data. Directive 95/46/EC deals with the protection of individuals with regard to the processing of personal data and the free movement of such data, where personal data means any information relating to an identified or identifiable natural person. One of the main ideas of this Directive is that data processing systems must respect the fundamental rights and freedoms, especially the right to privacy. Similar laws and directives regarding informational privacy have been proposed in the US and other developed countries. These include Internet privacy, medical privacy, financial privacy, law enforcement privacy, and political privacy.
There are currently numerous methods available to provide security to a database containing data intended to be held private to third parties. This problem is solved by methods of secure authentication. These methods are widely used to protect the security of databases containing medical, financial, and other types of data. An additional level of security can be added by encrypting all the data contained within the secure database and transmitted to and from the secure database during uploading or downloading operations. This is especially useful when data must be transmitted over a potentially unsecure medium such as computer networks. However, even in these increased security systems at some point the encrypted data is decrypted by an authorized user to perform the necessary data analysis tasks. For instance, in the case of medical research the secure clinical data management system containing the encrypted clinical data and physiological time-series corresponding to a particular study, research, or clinical trial requires the authorized researcher to decrypt the data in order to perform the needed mathematical analysis, signal processing, and statistical analysis in order to generate the study results. There are situations where this conventional framework does not meet the security requirements, that is, in order to analyze and process the encrypted data, such data should not be first decrypted (i.e. the data should be kept encrypted at all times). There are situations where data should be completely private even to researchers, clinical administrators, and system administrators. This may be due to purely privacy reasons or due to research considerations. For instance, certain studies may require scientists and researchers to be completely blinded and the hypothesis and analysis methods to be chosen a-priori. In order to accomplish this, methods for performing the typical mathematical operations and computations including statistical analysis techniques, algebraic methods, signal processing methods, and other computation operations directly on the encrypted datasets are needed. Currently, the availability of such secure methods and cryptosystems is limited.
Conventional cryptographic protocols deal with the problem of protecting some private information from an unauthorized third party that otherwise could modify or have access to the information. In the scenario of secure processing, where the privacy must be preserved not only against an unauthorized third party, but also against the parties that process the data, there are no available systems or methods that can be used in real-world scenarios in terms of both computational cost and communication complexity.
Up to now, the efficient protocols presented in the field of signal processing in the encrypted domain have been focused on linear operations, like scalar products, and non-iterative algorithms. Nevertheless, there are many basic algorithms needed for most signal processing applications that are iterative and involve not only scalar products with known values, but also products between two a-priori unknown sequences. The lack of these algorithms would suppose missing a powerful and irreplaceable tool that enables almost any signal processing application and most types of analysis methods.
Currently there is no practical fully homomorphic cryptosystem, that is, there is no secure cryptosystem that allows for the homomorphic computation of additions and products without restrictions. There has been a recent contribution by Gentry that presents a cryptosystem based on ideal lattices with bootstrappable decryption, and it has been shown that it achieves a full homomorphism. Nevertheless, the authors of this method concede that making the scheme practical remains an open problem.
At the moment there are no cryptosystems available that are capable of performing computations such as solving systems of linear equations without imposing any restrictions on the matrix coefficients. These cryptosystems are a critical building block needed to develop and implement more complex cryptosystems capable of performing advanced signal processing, computation, and analysis directly on encrypted data.
SUMMARY
According to one embodiment, the proposed system involves a cryptographic system (i.e. a cryptosystem) for the execution of operations directly on encrypted data, that is, a system designed to address the problem of efficiently processing signals in untrusted environments, where not only the communication channel between parties is unsecure, but also the parties that perform the computation cannot be trusted.
Disclosed embodiments include a cryptographic system implemented in at least one digital computer with one or more processors or hardware such as FPGAs for performing secure computations, analysis, and signal processing directly on encrypted data in untrusted environments. According to a basic embodiment, the proposed cryptographic system comprises: (a) at least one secure protocol for performing matrix multiplications in the encrypted domain, and (b) at least one secure protocol for solving systems of linear equations in the encrypted domain. According to a particular embodiment, and without limitation, the system comprises a plurality of privacy-preserving protocols for solving systems of linear equations (SLE) directly based on homomorphic computation and secret sharing. More specifically, according to a particular embodiment, and without limitation, the system uses a protocol whereby systems of linear equations are solved securely by direct Gaussian elimination using a secure protocol without imposing any restrictions on the matrix coefficients.
BRIEF DESCRIPTION OF THE DRAWINGS
Disclosed embodiments are illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings.
FIG. 1 shows a block diagram to illustrate the cryptographic system according to one embodiment.
FIG. 2 shows a high level block diagram to illustrate the operation of the cryptographic system.
FIG. 3 shows a block diagram to illustrate the secure protocol for solving systems of linear equations in the encrypted domain according to one embodiment.
DETAILED DESCRIPTION
FIG. 1 shows a block diagram of the cryptographic system 102 according to one embodiment. The embodiments disclosed describe how to realize a cryptographic system 102 for performing secure mathematical computations, signal processing, statistical signal processing, statistics, and data analysis directly on encrypted data 100 in untrusted environments. According to one embodiment, the system involves a cryptosystem 102 for the execution of operations directly on encrypted data 100, that is, a system designed to address the problem of efficiently processing signals in untrusted environments, where not only the communication channel between parties is unsecure, but also the parties that perform the computation cannot be trusted.
Certain specific details are set forth in the following description and figures to provide a thorough understanding of various embodiments disclosed. Certain well-known details often associated with computing and software technology are not set forth in the following disclosure to avoid unnecessarily obscuring the various disclosed embodiments. Further, those of ordinary skill in the relevant art will understand that they can practice other embodiments without one or more of the details described below. Aspects of the disclosed embodiments may be implemented in the general context of computer-executable instructions, such as program modules, being executed by a computer, computer server, or device containing a processor. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. Aspects of the disclosed embodiments may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote storage media including memory storage devices. Those skilled in the art will appreciate that, given the description of the modules comprising the disclosed embodiments provided in this specification, it is a routine matter to provide working systems which will work on a variety of known and commonly available technologies capable of incorporating the features described herein.
According to a disclosed embodiment, the cryptographic system 102 is implemented in a digital computer with one or more processors for performing secure computations and signal processing directly on encrypted data 100 in untrusted environments, said cryptographic system 102 comprises: (a) at least one secure protocol for performing matrix multiplications in the encrypted domain 104, and (b) at least one secure protocol for solving systems of linear equations in the encrypted domain 106. According to a particular embodiment, and without limitation, the system uses a protocol whereby systems of linear equations are solved securely by direct Gaussian elimination using a secure multiplication protocol to directly generate the results 112 of such secure mathematical computations, signal processing, statistical signal processing, statistics, and data analysis directly on encrypted data 100 in untrusted environments. According to other embodiments the disclosed cryptosystem can be implemented in other hardware besides a digital computer including microcontrollers, DSPs, FPGAs or ASICs, as well as in firmware and software.
The disclosed embodiments of the cryptosystem 102 and associated secure protocols have specific and substantial utility by themselves as systems and methods for cryptography and secure (encrypted) computation but also in a variety of practical applications in diverse fields including secure clinical data management systems, secure web-enabled platforms for collaboration involving privacy data, secure law enforcement systems, secure financial systems, and secure military systems involving transmission of encrypted data to be processed in real-time without decryption.
According to a basic embodiment, the proposed cryptographic system 102 comprises: (a) at least one secure protocol for performing matrix multiplications in the encrypted domain 104, and (b) at least one secure protocol for solving systems of linear equations in the encrypted domain 106 whereby systems of linear equations are solved securely by direct Gaussian elimination using a secure multiplication protocol based on homomorphic computation 108 and secret sharing 110 without placing any restrictions on the nature of the matrix coefficients (i.e. the matrix coefficients can be real numbers or complex numbers).
By way of example, and not by way of limitation, the embodiments of the disclosed cryptosystem 102 can be used to perform direct analysis and processing in encrypted clinical, financial, national security, military, law enforcement, and political data without the need to decrypt said data prior to performing said analysis and processing. For instance, according to one embodiment the disclosed cryptosystem 102 can be used to realize and implement a secure clinical system wherein all patient data, clinical history, clinical data, physiologic data and time series, biochemical data, and drug therapy data are encrypted at all times for secure transmission, management, and collaboration among researchers and clinicians; and all operations, processing, and statistical analysis performed on such data is conducted on the encrypted domain (i.e. with the data encrypted at all times). A specific particular embodiment of such secure clinical data management and analysis system comprises (a) at least one secure protocol for performing matrix multiplications in the encrypted domain 104, and (b) at least one secure protocol for solving systems of linear equations in the encrypted domain 106 in addition to the well-known elements comprising clinical management systems. According to a more specific embodiment, such protocol for solving systems of linear equations in said secure clinical data management system is based on a direct implementation of Gaussian elimination using a secure protocol.
FIG. 2 shows a high level diagram to illustrate the operation of the cryptographic system according to one embodiment. In the embodiment illustrated, and without limitation, there are two parties
Figure US08433925-20130430-P00001
200 and
Figure US08433925-20130430-P00002
220. The first party owns an encrypted matrix [[A]] and an encrypted vector [[b]], as well as the key for producing encryptions using a homomorphic encryption 202. The party
Figure US08433925-20130430-P00002
owns both the encryption and decryption key 216 for the same homomorphic encryption. The cryptographic system is used at both ends 206 and 212 in order to privately solve the linear system of equations A·x=b. This cryptographic system comprises a protocol of communication between both ends 208 and 214 that defines the operations performed and the format of the interchanged numbers in order to interactively solve the system without disclosing any information. This communication takes place over any communication channel 210 (e.g., a wired or wireless medium or a sole device). After the execution of the protocol, the system outputs the solution x 204 and 218 to the linear system of equations A·x=b. It is important to note that both
Figure US08433925-20130430-P00001
and
Figure US08433925-20130430-P00002
can represent a plurality of parties or entities (not necessarily a single entity).
Secure matrix multiplication (linear transformations) and solving linear systems of equations in the encrypted domain are fundamental mathematical building blocks to solve a great variety of problems involving data analysis, time-series analysis, digital signal processing, statistical signal processing, optimal filtering, adaptive filtering, digital communications, coding, encryption, information theory, and any other problem involving the least squares framework and representation of signals in vector spaces.
While particular embodiments are described, it is understood that, after learning the teachings contained in this disclosure, modifications and generalizations will be apparent to those skilled in the art without departing from the spirit of the disclosed embodiments.
A. Mathematical Notation.
In the detailed description the following mathematical notation is used. The mathematical notation is thoroughly described in this section to aid those skilled in the art to understand, implement, and practice the disclosed embodiments.
In the description we use indistinctly lowercase letters to represent classes in a ring (
Figure US08433925-20130430-P00003
, +, ·) and a representative of that class in the interval [0, n). ┌.┘ represents the rounding function of a number to the nearest integer.
The used vectors have size L and are represented by lower-case boldface letters, whereas matrices are represented by upper-case boldface letters. A′={ai,j}r,s t,u represents the submatrix of A of size (t−r+1)×(u−s+1), defined by a′i,j=ai+r−1,j+s−1.
The encryption of a number x is represented by [[x]], and the vector (matrix) formed by the encryptions of the vector x (matrix X) is represented by [[x]] ([[X]]).
The operations performed between encrypted and clear numbers are indicated as if they were performed in the clear; e.g. [[X]]·b represents the encryption of [[X·b]].
Regarding the complexity calculations, the complexity of basic modular operations, like additions (A), products (P) and exponentiations (X) is denoted by CompA, CompP, CompX respectively, prefixing an E (i.e. EA, EP, EX) when they are performed under encryption. The factor ct<1 denotes the ratio between the size of a clear-text value and that of an encrypted value. Finally, the subscript cm denotes communication complexity, measured in number of sent encryptions, while cp indicates computational complexity, with an indication of the party whose complexity is represented.
B. Techniques Employed According to One Embodiment.
According to one embodiment, the cryptographic system 102 uses secure multiparty computation techniques including homomorphic encryption and secret sharing.
According to one embodiment the cryptographic system 102 makes use of homomorphisms between the groups of clear-text and cipher-text, that allow for the execution of a given operation directly on encrypted values, without the need for decryption. This includes homomorphic RSA cryptosystem, with a multiplicative homomorphism, or Paillier with an additive homomorphism. The methods implemented are not restricted to the use of cryptosystem for the presented protocols, as far as it presents an additive homomorphism. In this embodiment the system 102 uses an extension of Paillier encryption in its threshold and non-threshold form; that is, a k out of M threshold public key encryption system is a cryptosystem where the private key is distributed among M parties, and at least k of them are needed for decryption.
According to one embodiment the cryptographic system 102 makes use of secret sharing. In this embodiment a given value (the secret) is divided among several parties, such that the cooperation among a number of these parties is needed in order to recover the secret. None of the parties alone can have access to the secret. According to one embodiment the scheme is based on polynomials, and the need of k points in order to completely determine a degree (k−1) polynomial. The disclosed embodiment uses secret sharing for two-party protocols based on linear functions, without limitation, since each party can represent a plurality of entities. According to one embodiment, the system supports the computation of sums and products directly on the shares as follows: 1) let
Figure US08433925-20130430-P00003
be the domain of the secrets; 2) then, a share of a secret x is defined as two values xA and xB, owned by their respective parties, such that xA+xB≡mod n; 3) hereinafter, randomizing an encrypted value x means obtaining one share and providing the encryption of the other (through homomorphic addition).
C. Definitions of Protocols and Constructions According to One Embodiment.
According to one embodiment of the cryptosystem 102, and without limitation, the protocols are based on two parties,
Figure US08433925-20130430-P00001
and
Figure US08433925-20130430-P00002
, both using an additively homomorphic cryptosystem in an asymmetric scenario, where
Figure US08433925-20130430-P00001
can only encrypt, but
Figure US08433925-20130430-P00002
also possesses the decryption key, and can perform both encryption and decryption. For the problem of solving an SLE A·x=b, the system requires that
Figure US08433925-20130430-P00001
owns an encrypted version of the system matrix [[A]], and of the independent vector [[b]].
According to one embodiment, and without limitation, the SLE may have A being either a positive definite matrix or a strictly diagonally dominant matrix. In this particular case, it can be guaranteed both a solution to the system and the convergence of the studied methods, as detailed later.
Regarding the privacy requirements, according to one embodiment the cryptosystem 102 is especially adapted for semi-honest parties, in the sense that they adhere to the established protocol, but they can be curious about the information they can get from the interaction. In this embodiment, the protocols can be proven private; informally, both parties
Figure US08433925-20130430-P00001
and
Figure US08433925-20130430-P00002
can only get the information leaked from the solution to the system, and no information is leaked from the intermediate steps of the protocols.
D. Secure Computational Engine and Method for Multiplying Matrices in the Encrypted Domain.
In order to multiply two encrypted matrices, as there is no multiplication operation in an additively homomorphic cryptosystem, it is necessary to execute an interactive protocol in order to perform each product. According to one embodiment, the systems uses the following method for non-threshold encryption.
According to one embodiment of the secure protocol, and without limitation, it is assumed that there exists an additively homomorphic cryptosystem with plaintext in
Figure US08433925-20130430-P00003
such that
Figure US08433925-20130430-P00002
can decrypt and both
Figure US08433925-20130430-P00001
and
Figure US08433925-20130430-P00002
can encrypt. In this embodiment,
Figure US08433925-20130430-P00001
owns two encrypted scalars [[x1]] and [[x2]] and wants to multiply them under encryption. In order to do that, according to one embodiment
Figure US08433925-20130430-P00001
generates two random values r1, r2ε
Figure US08433925-20130430-P00003
, and uses them to blind both numbers, using homomorphic modulo-n sum obtaining [[z1]]=[[x1]]+r1 mod n, and [[z2]]=[[x2]]+r2 mod n, and sends them to
Figure US08433925-20130430-P00002
.
According to one embodiment of the method, due to his decryption capabilities,
Figure US08433925-20130430-P00002
can obtain z1 and z2 in the clear, multiply them, and reencrypt the result [[z1·z2]].
Figure US08433925-20130430-P00002
sends this encrypted product to
Figure US08433925-20130430-P00001
, who, through homomorphic sums, can obtain the desired result, as
[[x 1 ·x 2 ]]=[[z 1 ·z 2 ]]−r 1 [[x 2 ]]−r 2 [[x 1 ]]−r 1 r 2.
According to the embodiment involving a threshold homomorphic cryptosystem, the procedure is analogous, with the exception that the random values must be generated by both parties.
According to the embodiment involving a product of an L×M matrix and a scalar, the protocol is exactly the same as the scalar-scalar case, with L×M scalar products in parallel.
According to the embodiment involving a matrix-matrix product, all the scalar products are performed using the scalar-scalar product protocol in parallel, with only one randomization per matrix coefficient, and the remaining operations are sums, that can be performed homomorphically. According to one embodiment, in order to minimize the computation and communication complexity,
Figure US08433925-20130430-P00001
may let
Figure US08433925-20130430-P00002
perform all the partial additions that
Figure US08433925-20130430-P00002
can do in the clear and
Figure US08433925-20130430-P00001
would need to do homomorphically.
Neglecting the complexity of the random number generation algorithms, the complexity of the whole protocol, when multiplying an L×M matrix and an M×N matrix is
CompcmMULT(L,M,N)=M·(L+N)+L·N
CompcpMULT,A(L,M,N)=L·N·M·(3CompEA+2CompEP)
CompcpMULT,B(L,M,N)=M·(L+N)CompDecrypt +M·L·NCompP +L·N·((M−1)CompA+CompEncrypt).
E. Secure Computational Engine and Method for Solving Linear Equations in the Encrypted Domain.
FIG. 3 shows a block diagram of the direct method for solving systems of linear equations in the encrypted domain according to one embodiment. According to one embodiment, the cryptosystem 102 includes a method for solving systems of linear equations directly on the encrypted data 100 (i.e. without the need to decrypt the data). The method is based on Gaussian elimination, using the secure multiplication protocol for implementing the needed multiplications. Due to the lack of a division operation under encryption, according to one embodiment of the method and cryptosystem 102 the obtained result vector is scaled, but the scale factors are stored in a second vector s, so that the solution can be recovered after decryption through a component-wise division. The protocol ends with two vectors x′ and s, being the solution to the system
x i = x i s i ,
i=1, . . . , L.
Below is a detailed description of the methods to implement the secure protocols for solving linear systems of equations according to particular embodiments. Briefly, let L denote the dimension of the system matrix A. For L−1 iterations, being k the number of the iteration ascending from 1 to L−1, according to one embodiment the system repeats the following steps:
Figure US08433925-20130430-P00001
randomizes the encryptions of [[C(k)]] 300;
Figure US08433925-20130430-P00001
sends the randomized encryptions of [[C(k)]] to
Figure US08433925-20130430-P00002
302;
Figure US08433925-20130430-P00002
calculates the products [[D(k)]] and [[E(k)]], using the received encryptions 304;
Figure US08433925-20130430-P00002
sends the encrypted [[D(k)]] and [[E(k)]] to
Figure US08433925-20130430-P00001
306;
Figure US08433925-20130430-P00001
calculates [[G(k)]] and [[C(k+1)]], using the received encryptions 308. Then,
Figure US08433925-20130430-P00001
possesses the encrypted scaling vector, and sends it to
Figure US08433925-20130430-P00002
310.
Figure US08433925-20130430-P00002
decrypts the received scaling vector and the value of x″L 312.
Figure US08433925-20130430-P00002
sends the decrypted scaling vector and x′L to
Figure US08433925-20130430-P00001
314. Then, for L−1 iterations, being k the number of the iteration, descending from L−1 to 1, the following steps are repeated:
Figure US08433925-20130430-P00001
calculates the encrypted [[x′k]], using the values that
Figure US08433925-20130430-P00001
possesses 316;
Figure US08433925-20130430-P00001
sends the encrypted [[x′k]] to
Figure US08433925-20130430-P00002
318;
Figure US08433925-20130430-P00002
decrypts [[x′k]] 320;
Figure US08433925-20130430-P00002
sends the decrypted x′k to
Figure US08433925-20130430-P00001
322. After these operations,
Figure US08433925-20130430-P00001
and
Figure US08433925-20130430-P00002
calculate the solution x to the system of linear equations A·x=b, using the values that they possess 324.
Let Aε
Figure US08433925-20130430-P00004
L×L(
Figure US08433925-20130430-P00005
) be a quantized symmetric positive-definite matrix, or a diagonally dominant matrix, and bε
Figure US08433925-20130430-P00006
be a quantized column vector. The quantization step Δ is such that the absolute value of every quantized element is upper bounded by a constant T.
According to one embodiment, and without limitation, the secure protocol method assumes that
Figure US08433925-20130430-P00002
knows the decryption key of an additive homomorphic cryptosystem, and both
Figure US08433925-20130430-P00001
and
Figure US08433925-20130430-P00002
can produce encryptions using this cryptosystem;
Figure US08433925-20130430-P00001
possesses the encrypted matrix [[A]] and the encrypted vector of independent terms [[b]]. Both parties engage in an interactive protocol in order to obtain the solution x to the linear system A·x=b. According to one embodiment, the protocol is described in detail as follows.
Following the Gaussian elimination algorithm, we call G(0)=G to the concatenation of G=[A|b]. The algorithm is executed in L−1 steps. At each step k, the matrix G is modified to obtain an equivalent system G(k) in which the k-th unknown is not present in the last L−k equations.
For the k-th step of the algorithm, the first k−1 elements of the L−k+1 last rows of G(k−1) are zero;
Figure US08433925-20130430-P00001
owns an encrypted version of the non-zeroed elements of G(k−1). The secure protocol proceeds as follows:
    • 1.
      Figure US08433925-20130430-P00001
      provides randomized encrypted versions of the submatrix C(k) formed by the last (L−k+2) columns of the last (L−k+1) rows of G(k−1);
    • 2.
      Figure US08433925-20130430-P00002
      , through decryption and reencryption, calculates the (randomized) products of the (L−k)×(L−k+1) matrices D(k) and E(k), defined as [[dj,m (k)]]=[[c1,m+1 (k)·cj+1,1 (k)]], and [[ei,j (k)]]=[[c1,1 (k)·ci+1,j+1 (k)]], and sends the randomized encryptions to
      Figure US08433925-20130430-P00001
      .
3.
Figure US08433925-20130430-P00001
derandomizes the received encryptions and, using homomorphic operations, obtains the next iteration of G:
G ( k ) = ( { g i , m ( k - 1 ) } ( 1 , 1 ) ( k , L + 1 ) 0 L - k , k F ( k ) ) ,
    • where [[F(k)]] is an (L−k)×(L−k+1) matrix with elements [[fi,m (k)]]=[[ei,m (k)]]−[[di,m (k)]].
After L−1 iterations,
Figure US08433925-20130430-P00001
has an encrypted upper triangular matrix appended to an encrypted vector, [[G(L−1)]], that constitute a system with the same solution as the original one.
According to one embodiment, in order to solve the system of linear equations, both parties initiate the process of back substitution under encryption, consisting of L iterations: in each iteration, an element of the vector x′ and the corresponding element of the scale vector s are obtained. As they are revealed at the output, and they are needed in order to calculate the subsequent elements of x′, they can be decrypted before the next iteration in order to lower the complexity by reducing the number of the needed multiplication protocols. For the first step:
    • 1.
      Figure US08433925-20130430-P00001
      sends {[[gi,i (L−1)]]}i=1 L and [[gL,L+1 (L−1)]].
    • 2.
      Figure US08433925-20130430-P00002
      obtains, through decryption, the scaling vector s, with sil=i (L)gl,l (L−1), and the value x′L=gL,L+1 (L−1), and sends them back to
      Figure US08433925-20130430-P00001
      .
In each subsequent k-th step,
Figure US08433925-20130430-P00001
calculates, using homomorphic operations:
x L - k + 1 = g L - k + 1 , L + 1 ( L - 1 ) · s L - k + 2 - l = L - k + 2 L g L - k + 1 , l ( L - 1 ) · x l s l s L - k + 2 ,
and sends [[x′L−k+1]] to
Figure US08433925-20130430-P00002
to obtain its decryption.
With this embodiment of the protocol, the system does not disclose any element of the original matrix A nor of the independent terms vector b. Furthermore, every step of the protocol can be proven secure with semi-honest parties, due to the semantical security of the underlying homomorphic cryptosystem, the security of the used multiplication protocols, and the fact that all the unencrypted values (besides the result and the scaling vector) that each party can access are random and uncorrelated. Nevertheless, the scaling vector reveals the diagonal of the upper triangular matrix of an equivalent system, which gives information about the eigenvalues of the original matrix. This information affects L scaled elements out of
L ( L + 1 ) 2 .
It must be noted that having the values of the principal diagonal of the upper-triangular matrix of the equivalent system yields the possibility of calculating its condition number, or at least, its bound
κ ( U ) max i ( u ii ) min i ( u ii ) .
Thus, this disclosed embodiment constitutes a clear advantage in terms of conditioning and efficiency: before executing the back substitution protocol, the rows of G(L) can be multiplied by appropriate factors in order to lower the condition number and minimize error propagation due to working with a fixed point precision. Also, the vector of multiplicative factors si can be adequately quantized in the clear to achieve this same goal.
The disclosed embodiment of the protocol does not limit the number N of SLEs sharing the same system matrix A and with different independent term vectors bi that can be solved in parallel; all the vectors bi can be appended to the system matrix, forming a L×(L+N) matrix Gext and at each step of the previous protocol, the operations that must be performed on the last column of G(k) are replicated for the last N columns of Gext (k).
When solving one system A·x=b, the Gaussian Elimination (GE) protocol is performed in (L−1) rounds of communication, with total complexity
Comp cmGE = ( L 3 + L 2 - 2 ) Comp cpGE , A = 1 3 ( L 3 + 3 L 2 + 2 L - 6 ) Comp Encrypt + 1 3 ( 2 L 3 + 3 L 2 + L - 6 ) Comp EA Comp cpGE , B = 1 3 ( L 3 + 3 L 2 + 2 L - 6 ) Comp Decrypt + 2 3 ( L 3 - L ) ( Comp Encrypt + Comp P ) .
The protocol of Back Substitution (BS) is performed in L rounds of communication, with total complexity
Comp cmBS = 2 L · ( 1 + ct ) Comp cpBS , A = 1 2 ( L 2 + L - 2 ) Comp EP + 1 2 ( L 2 - L ) Comp EA Comp cpBS , B = 2 LComp Decrypt .
According to one embodiment the coefficients of the system matrix A are quantized versions of the real-valued coefficients, with a quantization step Δ. Furthermore, the absolute value of the quantized coefficients is bounded by an integer T>0. Then, it is possible to estimate the value of T needed to fit all the performed operations inside a cipher that can represent integers in the range [0, n) without rounding problems.
For the first part of the protocol according to one embodiment (the direct secure Gaussian elimination), each iteration multiplies two numbers that were obtained in the previous iteration and adds them up, so the previous bound gets squared and doubled:
|t 1 |,|t 2 |,|t 3 |,|t 4 |<T
Figure US08433925-20130430-P00007
|t 1 ·t 2 −t 3 ·t 4|<2T 2.
In this embodiment all the elements of the k-th row of the resulting G(L−1) are bounded by (22 k−1 −1)T2 k , and constitute the representation of their real-valued equivalents, quantized by Δ2 k−1 . Thus, the cipher must be such that n>(22 k−1 −1)T2 k in order to fit all the numbers involved in this protocol. This means that the bit size of the modulus of the cipher must grow exponentially with the dimensionality of the system, which results in poor scalability.
For the second part of the protocol according to this embodiment, after the diagonal elements are disclosed, they can be re-quantized in order to make them relative to the lowest scale and lower the bit-size requirements of the cipher; but in the worst case, without re-quantizing the scale factors, the largest number present after running the whole protocol is 22 L−1 T2 1+L −4. That also constrains the size of the cipher.
F. Extension to Systems with Complex Elements According to One Embodiment.
The protocol presented in the earlier section does not impose any restrictions on the matrix coefficients. It can be used for both unrestricted real coefficients and complex coefficients. In this section we explain how the protocol can be implemented in the case of complex coefficients.
For convenience, and without loss of generality, a binomial representation is chosen for complex numbers; the encryption of a complex number [[x]] is given by the pair [[x]]
Figure US08433925-20130430-P00008
([[
Figure US08433925-20130430-P00009
{x}]], [[
Figure US08433925-20130430-P00010
{x}]]), that is, the pair of encryptions of its real and imaginary parts.
According to one embodiment, the complex addition operation can be performed through two real additions; thus, it can be performed homomorphically between two encrypted complex numbers as two homomorphic real additions. Regarding the complex product, when it involves one known factor and one encrypted number, it can also be performed homomorphically as four homomorphic multiplications and two homomorphic additions. When involving two encrypted factors, it is performed through four parallel (real) scalar multiplication protocols and two homomorphic additions.
Thus, the matrix multiplication protocol disclosed in the previous section works on complex numbers by adopting the proposed encrypted complex representation, and by substituting the real additions and products by their corresponding complex operations. As a result, the communication complexity is doubled, the number of performed products is multiplied by four, and the number of performed additions is doubled.
For the secure SLE solving protocol, the needed modifications are essentially the same, being the involved scale factors also complex. We must remark that the hypotheses on the system matrix that were imposed for ensuring the convergence of the algorithms are kept unaltered when dealing with systems with complex coefficients, as they are general hypotheses not restricted to systems with real coefficients.
While particular embodiments have been described, it is understood that, after learning the teachings contained in this disclosure, modifications and generalizations will be apparent to those skilled in the art without departing from the spirit of the disclosed embodiments. It is noted that the foregoing examples have been provided merely for the purpose of explanation and are in no way to be construed as limiting. While the system has been described with reference to various embodiments, it is understood that the words which have been used herein are words of description and illustration, rather than words of limitations. Further, although the system has been described herein with reference to particular means, materials and embodiments, the actual embodiments are not intended to be limited to the particulars disclosed herein; rather, the system extends to all functionally equivalent structures, methods and uses, such as are within the scope of the appended claims. Those skilled in the art, having the benefit of the teachings of this specification, may effect numerous modifications thereto and changes may be made without departing from the scope and spirit of the disclosed embodiments in its aspects.

Claims (5)

The invention claimed is:
1. A cryptographic system including at least one hardware device having at least one processor or in at least one integrated circuit, said cryptographic system comprising:
(a) at least one secure protocol for performing matrix multiplications in an encrypted domain; and
(b) at least one secure protocol for solving systems of linear equations in the encrypted domain without imposing restrictions on one or more matrix coefficients, said secure protocol for solving systems of linear equations in the encrypted domain implemented using a direct method of Gaussian elimination using said secure protocol for performing matrix multiplication in the encrypted domain;
whereby said cryptographic system performs secure computations, signal processing, and data analysis directly on encrypted data in untrusted environments without the need to decrypt said encrypted data.
2. The cryptographic system of claim 1, wherein said secure protocol for solving systems of linear equations in the encrypted domain is based on privacy-preserving protocols based on homomorphic computation.
3. The cryptographic system of claim 2, wherein said secure protocol for solving systems of linear equations in the encrypted domain is based on privacy-preserving protocols based on homomorphic computation and secret sharing.
4. The cryptographic system of claim 3, wherein said direct method of Gaussian elimination is further performed by:
(a) means for randomizing a set of input encryptions and calculating a set of encrypted matrices and a scaling vector based on homomorphic computation;
(b) means for decrypting said scaling vector; and
(c) means for calculating a set of encrypted elements of an output vector based on homomorphic computation, and decrypting elements of said output vector.
5. The cryptographic system according to claim 4, embodied on a non-transitory storage medium.
US12/876,223 2009-09-04 2010-09-06 Cryptographic system for performing secure computations and signal processing directly on encrypted data in untrusted environments Active 2031-03-23 US8433925B2 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US12/876,223 US8433925B2 (en) 2009-09-04 2010-09-06 Cryptographic system for performing secure computations and signal processing directly on encrypted data in untrusted environments
US13/761,448 US8972742B2 (en) 2009-09-04 2013-02-07 System for secure image recognition

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US24017709P 2009-09-04 2009-09-04
US12/876,223 US8433925B2 (en) 2009-09-04 2010-09-06 Cryptographic system for performing secure computations and signal processing directly on encrypted data in untrusted environments

Publications (2)

Publication Number Publication Date
US20110060917A1 US20110060917A1 (en) 2011-03-10
US8433925B2 true US8433925B2 (en) 2013-04-30

Family

ID=43648567

Family Applications (1)

Application Number Title Priority Date Filing Date
US12/876,223 Active 2031-03-23 US8433925B2 (en) 2009-09-04 2010-09-06 Cryptographic system for performing secure computations and signal processing directly on encrypted data in untrusted environments

Country Status (1)

Country Link
US (1) US8433925B2 (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8837715B2 (en) 2011-02-17 2014-09-16 Gradiant, Centro Tecnolóxico de Telecomunicacións de Galica Method and apparatus for secure iterative processing and adaptive filtering

Families Citing this family (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8891762B2 (en) * 2010-12-10 2014-11-18 Mitsubishi Electric Research Laboratories, Inc. Method for privacy-preserving order selection of encrypted element
US8549299B2 (en) * 2011-02-28 2013-10-01 Certicom Corp. Accelerated key agreement with assisted computations
US8627107B1 (en) 2011-09-29 2014-01-07 Todd Michael Kennedy System and method of securing private health information
US9054870B2 (en) 2012-10-22 2015-06-09 Donatello Apelusion Gassi Information security based on eigendecomposition
EP2905922A1 (en) * 2014-02-10 2015-08-12 Thomson Licensing Signing method delivering a partial signature associated to a message, threshold signing method, signature verification method, and corresponding computer program and electronic devices
US9729312B2 (en) 2015-04-28 2017-08-08 The United States Of America As Represented By The Secretary Of The Navy System and method for high-assurance data storage and processing based on homomorphic encryption
US20170293913A1 (en) * 2016-04-12 2017-10-12 The Governing Council Of The University Of Toronto System and methods for validating and performing operations on homomorphically encrypted data
WO2018061391A1 (en) * 2016-09-30 2018-04-05 日本電気株式会社 Secret computation system, secret computation device, secret computation method and secret computation program
US10496631B2 (en) * 2017-03-10 2019-12-03 Symphony Communication Services Holdings Llc Secure information retrieval and update
US11032061B2 (en) * 2018-04-27 2021-06-08 Microsoft Technology Licensing, Llc Enabling constant plaintext space in bootstrapping in fully homomorphic encryption
US11126709B2 (en) * 2019-01-28 2021-09-21 Nec Corporation Of America Secure multiparty computation of shuffle, sort, and set operations
CN112183564B (en) * 2019-07-04 2023-08-11 创新先进技术有限公司 Model training method, device and system
US11431470B2 (en) * 2019-08-19 2022-08-30 The Board Of Regents Of The University Of Texas System Performing computations on sensitive data while guaranteeing privacy
CN111461858B (en) * 2020-03-10 2023-02-17 支付宝(杭州)信息技术有限公司 Continuous multiplication calculation method, device and system based on privacy protection and electronic equipment
CN112527699A (en) * 2020-11-16 2021-03-19 中山大学 Method for safely calculating Nash equilibrium point in cloud computing environment

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070116283A1 (en) * 2003-11-03 2007-05-24 Koninklijke Philips Electronics N.V. Method and device for efficient multiparty multiplication
US7526084B2 (en) * 2005-09-02 2009-04-28 Mitsubishi Electric Research Laboratories, Inc. Secure classifying of data with Gaussian distributions
US20100106964A1 (en) * 2008-08-07 2010-04-29 Hitachi, Ltd. Authentication terminal, authentication server, and authentication system
US20110110525A1 (en) * 2009-11-10 2011-05-12 International Business Machines Corporation Fully homomorphic encryption method based on a bootstrappable encryption scheme, computer program and apparatus
US20120039463A1 (en) * 2010-08-16 2012-02-16 International Business Machines Corporation Fast Evaluation Of Many Polynomials With Small Coefficients On The Same Point
US8161463B2 (en) * 2007-02-23 2012-04-17 Irdeto Canada Corporation System and method of interlocking to protect software—mediated program and device behaviors

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070116283A1 (en) * 2003-11-03 2007-05-24 Koninklijke Philips Electronics N.V. Method and device for efficient multiparty multiplication
US7526084B2 (en) * 2005-09-02 2009-04-28 Mitsubishi Electric Research Laboratories, Inc. Secure classifying of data with Gaussian distributions
US8161463B2 (en) * 2007-02-23 2012-04-17 Irdeto Canada Corporation System and method of interlocking to protect software—mediated program and device behaviors
US20100106964A1 (en) * 2008-08-07 2010-04-29 Hitachi, Ltd. Authentication terminal, authentication server, and authentication system
US20110110525A1 (en) * 2009-11-10 2011-05-12 International Business Machines Corporation Fully homomorphic encryption method based on a bootstrappable encryption scheme, computer program and apparatus
US20120039463A1 (en) * 2010-08-16 2012-02-16 International Business Machines Corporation Fast Evaluation Of Many Polynomials With Small Coefficients On The Same Point

Non-Patent Citations (8)

* Cited by examiner, † Cited by third party
Title
A Simple Publicly Verifiable Secret Sharing Scheme and Its Application to Electronic Voting. Berry Schoenmakers. Advances in Cryptology-CRYPTO' 99. Lecture Notes in Computer Science, 1999, vol. 1666/1999, 784, DOI: 10.1007/3-540-48405-1-10. *
Bianchi et al. (Bianchi, T., Piva, A., Barni, M.): On the implementation of the discrete Fourier transform in the encrypted domain. IEEE Transactions on Information Forensics and Security 4(1) (2009) 86-97.
Communication Efficient Secure Linear Algebra. Kobbi Nissim and Enav Weinreb. Theory of Cryptography. Lecture Notes in Computer Science, 2006, vol. 3876/2006, 522-541, DOI: 10.1007/11681878-27. *
Craig Gentry. 2009. Fully homomorphic encryption using ideal lattices. In Proceedings of the 41st annual ACM symposium on Theory of computing (STOC '09). ACM, New York, NY, USA, 169-178. DOI=10.1145/1536414.1536440. *
Cramer et al. (Cramer, R., Damgard I.): Secure distributed linear algebra in a constant number of rounds. In: 21st Annual International Cryptology Conference on Advances in Cryptology. vol. 2139 of Lecture Notes in Computer Science., Springer (2001) 119-136.
Due et al. (Du, W., Atallah, M.J.): Privacy-preserving cooperative scientific computations. In: Proceedings of the 14th IEEE Computer Security Foundations Workshop, Nova Scotia, Canada (Jun. 2001) 273-282.
Goethals et al. (Goethals, B., Laur, S., Lipmaa, H., Mielikainen, T.): On private scalar product computation for privacy-preserving data mining. In Park, C., Chee, S., eds.: 7th Annual International Conference in Information Security and Cryptology (ICISC 2004). vol. 3506 of Lecture Notes in Computer Science., Seoul, Korea, Springer (Dec. 2004) 104-120.
Troncoso-Pastoriza et al. (Juan Ramón Troncoso-Pastoriza, Pedro Comesaña, and Fernando Pérez-González). Secure Direct and Iterative Protocols for Solving Systems of Linear Equations. In SPEED Workshop 2009, pp. 122-141, Lausanne, Switzerland, Sep. 2009.

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8837715B2 (en) 2011-02-17 2014-09-16 Gradiant, Centro Tecnolóxico de Telecomunicacións de Galica Method and apparatus for secure iterative processing and adaptive filtering

Also Published As

Publication number Publication date
US20110060917A1 (en) 2011-03-10

Similar Documents

Publication Publication Date Title
US8433925B2 (en) Cryptographic system for performing secure computations and signal processing directly on encrypted data in untrusted environments
US8843762B2 (en) Cryptographic system for performing secure iterative computations and signal processing directly on encrypted data in untrusted environments
US20110060901A1 (en) Cryptographic System for Performing Secure Iterative Matrix Inversions and Solving Systems of Linear Equations
US9571268B2 (en) Method and system for homomorphicly randomizing an input
Nikolaenko et al. Privacy-preserving ridge regression on hundreds of millions of records
US8972742B2 (en) System for secure image recognition
US8837715B2 (en) Method and apparatus for secure iterative processing and adaptive filtering
EP2813029B1 (en) System and method for generating and protecting cryptographic keys
Pedrouzo-Ulloa et al. Number theoretic transforms for secure signal processing
SaghaianNejadEsfahani et al. Privacy protected image denoising with secret shares
Dzwonkowski et al. Secure quaternion feistel cipher for DICOM images
CN110445797B (en) Two-party multidimensional data comparison method and system with privacy protection function
EP2317689B1 (en) Cryptographic system for performing secure computations and signal processing directly on encrypted data in untrusted environments
Zhang et al. Practical and secure outsourcing algorithms of matrix operations based on a novel matrix encryption method
Agrawal et al. Elliptic curve cryptography with hill cipher generation for secure text cryptosystem
Cheng et al. Strongly secure and efficient range queries in cloud databases under multiple keys
Lima et al. Fractional cosine and sine transforms over finite fields
Cheng et al. Manto: A practical and secure inference service of convolutional neural networks for iot
Shin et al. Securing a local training dataset size in federated learning
Almazrooie et al. Quantum Grover attack on the simplified-AES
Troncoso-Pastoriza et al. Secure direct and iterative protocols for solving systems of linear equations
Papadimitriou et al. Secure communication protocols with discrete nonlinear chaotic maps
Pathak et al. Efficient Protocols for Principal Eigenvector Computation over Private Data.
Huang et al. Secure word-level sorting based on fully homomorphic encryption
WO2023276740A1 (en) Third party device, secure computation system, and program

Legal Events

Date Code Title Description
AS Assignment

Owner name: GRADIANT, SPAIN

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:TRONCOSO PASTORIZA, JUAN RAMON;COMESANA ALFARO, PEDRO;PEREZ GONZALEZ, FERNANDO;REEL/FRAME:029811/0479

Effective date: 20130213

STCF Information on status: patent grant

Free format text: PATENTED CASE

FPAY Fee payment

Year of fee payment: 4

FEPP Fee payment procedure

Free format text: 7.5 YR SURCHARGE - LATE PMT W/IN 6 MO, SMALL ENTITY (ORIGINAL EVENT CODE: M2555); ENTITY STATUS OF PATENT OWNER: SMALL ENTITY

MAFP Maintenance fee payment

Free format text: PAYMENT OF MAINTENANCE FEE, 8TH YR, SMALL ENTITY (ORIGINAL EVENT CODE: M2552); ENTITY STATUS OF PATENT OWNER: SMALL ENTITY

Year of fee payment: 8